Privacy notice

Version 2026-10-18 · Make a data request

Who we are

Webresource Hub Ltd ("we", "us") builds and hosts business software and related services. For the personal data described here we are the data controller.

Data protection contact: info@webresourcehub.com.

What we collect

When you contact us or order: your name, organisation, phone, email, town, country and your message.
When you become a client: billing details (organisation name, KRA PIN, address), invoices, payments and their references (M-Pesa number, card or bank reference — we never see or store your card number).
When you ask for support: your messages, attachments and satisfaction rating.
When you visit the website: the pages you view and the site that referred you, counted with a code that changes every day and cannot identify you. We do not store your IP address for this.
If you work for us: the records needed to employ and pay you — described in the staff handbook.

Why we use it, and on what legal basis

To reply to your enquiry and give demos and quotes — your consent, which you give when you send the form.
To provide what you ordered, bill you and support you — performance of our contract with you.
To keep accounting and tax records — legal obligation (Tax Procedures Act, VAT Act).
To keep our systems secure and prevent fraud — legitimate interests, balanced against your rights.
To send news and offers — only with your consent, which is never pre-ticked and which you can withdraw at any time with the link in every message.

We do not sell personal data, and we do not make decisions about you by automated means alone.

Data you keep in our software

When your organisation uses our software, it decides what data goes in (for example customers, learners and parents, members or staff) and is the data controller for it. We are its data processor: we use that data only on your instructions and only to provide the service, under our data processing terms.

Some of this data is sensitive — children's records in schools, or church membership, which reveals religious belief. We protect it accordingly, and our clients are responsible for having a lawful basis for it, including a parent's or guardian's consent for children where the Act requires it (s.33).

If you are a learner, parent, member or customer of one of our clients, please send your request to that organisation first. We will help them answer it.

Only those we need to provide our services, each bound to protect it:

web hosting and email providers;
Safaricom (M-Pesa), Flutterwave (card payments) and our bank;
Africa's Talking (SMS);
the Kenya Revenue Authority, auditors, and courts or authorities where the law requires it.

Data sent outside Kenya

Some providers — for example our hosting company and the card processor — may hold data outside Kenya. We use them only with safeguards the Act requires (s.48–50): contracts that protect the data to Kenyan standards, and providers in countries with adequate protection. Ask us for details of the safeguard that applies to your data.

How long we keep it

Enquiries and leads that did not lead to an order: 24 months.
Client accounts: while you are a client; then invoices, receipts and the details on them for 7 years after the last invoice, as tax law requires.
Closed support tickets: 36 months.
Copies of emails and SMS we sent you: 180 days.
Website visit counts (anonymous): 13 months.
Sign-in and security records: 90 days; the audit log of staff actions: 7 years.

Our system removes or anonymises data automatically when these periods end.

How we protect it

Encrypted connections (HTTPS), staff access limited to what each role needs, hashed passwords, automatic sign-out, a log of who did what, daily backups and staff trained in confidentiality. If a breach could harm you, we will tell the Data Protection Commissioner within 72 hours and tell you without delay.

Your rights

Under the Data Protection Act, 2019 you have the right to:

be told how your data is used (this notice);
see the personal data we hold about you;
have it corrected if it is wrong or incomplete;
have it deleted when we no longer need it or have no right to keep it;
object to its use, including for marketing;
restrict its use while a complaint is resolved;
receive it in a machine-readable format and move it to another provider;
withdraw consent at any time (this does not affect what we did before).

Make a request on our data rights page or by email to info@webresourcehub.com. It is free. We confirm it is you before acting, and reply within 7 days for access and 14 days for most other requests. Some records — such as invoices — we must keep by law even if you ask us to delete them; we will tell you what and why.

If you are unhappy with how we handle your data, you may complain to the Office of the Data Protection Commissioner (www.odpc.go.ke). If you are in the European Union or the United Kingdom, you may also complain to your local data protection authority.

Cookies

We use only the cookies this website needs to work: one that keeps your session (for forms and sign-in) and one that remembers the currency you chose. No advertising, tracking or third-party cookies, and the fonts are served from our own server, so your browser does not contact other companies when you visit.

Children

Our website and services are for organisations and adults. We do not knowingly collect personal data directly from children. Schools that use our software decide what learner data it holds and must obtain any consent the Act requires.

Changes to this notice

We will update this notice when our practices change and show the new version date here. Version: 2026-10-18.